How To
Summary
When using Non-Kerberos SSO Authentication using the Server Variable Remote_User or something similar, you can ensure it is being used correctly by customizing IIS logging. If this variable is not set correctly Authentication cannot complete. This technique will help with Active Directory and LDAP Namespaces most notably. This also helps when using 3rd Party Authentication Tools like SiteMinder which will set a similar Server Side Variable.
Environment
This is for Microsoft Windows Server 2012 through 2019 using Internet Information Server (IIS).
Steps
- Open IIS Administration Tool
- Select the server name in the left hand Connections Window
- Select Logging icon in the middle window
- Under Log File > Format> Click "select fields..." button
- Then select Add field button bottom left corner
- Set the Field Name to: REMOTE_USER
- Select Source type: Server Variable
- Select Source: REMOTE_USER
- select Ok and then Ok again
- Select Apply in the top right hand corner
Open an Administrator CMD window
Run the command IISRESET to restart IIS
Additional Information
With this custom IIS logging in place you can reproduce the issue to see in the logging if the Username is present and it is in the format you are expecting.
The IIS logs are daily logs and are located in:
C:\inetpub\logs\LogFiles\W3SVC1
You should see a log entry looking similar to this:
<Timestamp> <IP Address> POST /ibmcognos/bi/v1/login - 80 <Domain>\<Username> 9.28.235.248 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko http://Server.Domain.TLD/ibmcognos/bi/ 200 0 0 4291 <Domain>\<Username>
Document Location
Worldwide
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSTSF6","label":"IBM Cognos Analytics"},"Component":"Gateway","Platform":[{"code":"PF033","label":"Windows"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}]
Was this topic helpful?
Document Information
Modified date:
28 November 2019
UID
ibm11116633